Vulnerability details
CVE-2025-37182
Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface
CVSS 3.1
7.2High
Official description
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.2High | 3.1 | CVEProject cvelistV5 (CNA) (hpe) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Orchestrator | 9.4.0 ≤ v ≤ 9.4.4 | CVEProject cvelistV5 (CNA) |
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Orchestrator | 9.5.0 ≤ v ≤ 9.6.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-14
- Last updated
- 2026-01-14
- State
- Published
- Assigner (CNA)
- hpe
Exploit prediction (EPSS)
0.48%
Probability of exploitation in 30 days
41.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')